Dataset level access restrictions in one workspace

[Nath_nath]

Users

John (Report user and “analyse in excel user”) may only use public reports or public datasets.

Workspace Datasets

Dataset Public
Dataset Private (composite model relying on Dataset public for conformed dimensions)

Workspace Reports

Report Public
Report Private

Current settings for John

• John has no “Workspace Datasets” level access. He is not even a viewer of the workspace.
• John has access to the “Dataset Public”. This is applied using the “manage permissions” settings of the “Dataset Public” within the “Workspace Datasets”.
• John has access to the whole “Workspace Reports”. This is done on workspace level and done to avoid to put settings on every individual report.

To my belief, John would now be able to enter the “Workspace Reports” and consult all reports there and use the “analyse in excel” functionality for the public report and dataset.
It is oke for him to see the “Report private” in the actual list as long as he will not see any data in the report when he opens the report (or receive a notification he has no dataset level access).

Currently I am facing the problem with above setup that he is still able to see filled private reports.

What I would like

I would like to find a method to publish all datasets and reports in one workspace datasets and workspace reports respectively and be able to distinguish on dataset level between access groups. Now this does not work and it seems I need to create different workspaces. 
To further simplify, the private dataset is a composite dataset.

Thank you!

[StefanoGrimaldi · Accepted solution]

if you deny the access to a user on the dataset per se they can try and consume it but will come out blank its the same as doing it with RLS but with RLS you have less complexity actually doing the way you looking for you need to set up user groups to manage the relantionship of users between workspace and dataset privilage per cases

[Anonymous · Accepted solution]

Hi @Nath_nath ,

Do you want different users to see different datasets in the consent workspace?  Please review the feature request and vote it, product team will consider it when more people need it.

Report level security within same Workspace 

Manage dataset access permissions (preview) 

The dataset manage permissions page enables you to monitor and manage access to your dataset. It has two tabs that help you control access to your dataset:

• Direct access: Enables you to monitor, add, modify, or delete access permissions for specific people or groups (distribution groups or security groups).
• Shared report links: Shows you links that were generated for sharing reports. Such links sometimes also give access to your dataset. On this tab you can review them and remove them if necessary.

If I have misunderstood your menaing, please provide more details with your desired.

Best Regards

Community Support Team _ Polly

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Nath_nath]

Hi @Anonymous  Thank you so much for your answer. This seems like what I am searching for.

However, I am a little confused.
- It seems what I am looking for is not a feature yet within power bi. This is what I learn from your reference to the feature request. I will upvote though 🙂

- However, the second part of your post suggests else. I see it is currently in preview mode. These settings I have tried myself (without success) and suggested me indeed it was possible to distinguish access on dataset level within the same workspace.

I do not really get why I do not get it working properly but I understand now this feature is simply not ready yet.

[Nath_nath]

@StefanoGrimaldi I am aware of this functionality but I believe this adds complexity. Users do not need to see particular data of the private dataset/report, but they can be restricted complety. I know this is also possible with RLS but why not easily restrict on datasetlevel, easy and understandable for everyone.

[StefanoGrimaldi · Accepted solution]

if you deny the access to a user on the dataset per se they can try and consume it but will come out blank its the same as doing it with RLS but with RLS you have less complexity actually doing the way you looking for you need to set up user groups to manage the relantionship of users between workspace and dataset privilage per cases

[StefanoGrimaldi]

RLS its as its name suggest a security even in excel analyses they wont be able to consume any data the RLS filters out or even see any of it 

[Nath_nath]

Hi thanks again for your reply. We have user groups already so it would just be a matter of adding the usergroups to the few datasets (mostly 4) we have. I still do not see how this is more complex than adding RLS. 

[StefanoGrimaldi]

have you trying using row level security for this? in any method even if he can get analyse to excel if he doesnt have at least read access the excel data will come up blank, and with RLS you can filter out what data the user profile can read from the dataset at all